The approaches described in this section could be pursued, but are not necessarily approaches that have been previously conceived or pursued. Therefore, unless otherwise indicated herein, the approaches described in this section are not prior art to the claims in this application and are not admitted to be prior art by inclusion in this section.
Currently, a system in networking to control what resources network devices can access is called an authentication, authorization and accounting (AAA) system. In the context of AAA systems, network devices that attempt to gain access to network resources are generally referred to as “supplicants.” Typically, system users cause supplicants to request access to particular resources. However, supplicants may also self-initiate access attempts for particular resources. These supplicants typically consist of laptops, desktop PCs, IP phones, VPN clients, handheld devices, and any other device that may request access to a network resource.
AAA systems include AAA clients and AAA servers. In AAA systems, supplicants typically attempt to gain access to network resources through AAA clients. AAA clients normally reside on network elements such as network access servers (NAS), routers, switches, firewalls, virtual private network (VPN) concentrators, and wireless access points (WAPs). However, AAA clients may reside on any device that facilitates access to network resources. The supplicant attempts are sent to the AAA client, which in turn generates and issues access requests to an AAA server. Typically, AAA servers handle access requests sent by AAA clients to access network resources by maintaining a database of user profiles, querying the database against access requests to verify authenticity, determining resources authorized for use, and accounting for the use of network resources. Communication between the AAA client and AAA server is facilitated via an AAA message protocol. Currently, a common AAA message protocol is Remote Authentication Dial-In User Service (RADIUS). Another AAA message protocol is the Terminal Access Controller Access Control Systems protocol (TACACS+).
Currently, AAA clients are capable of deciding which AAA server to issue access requests to on a limited basis. Specifically, conventional AAA clients are only capable of issuing access requests based on the AAA protocol that is used by a supplicant to contact the AAA client. Hence, AAA clients are only able to send authentication packets using RADIUS protocol requests to RADIUS AAA servers. Recent technologies, however, have fostered the development of various authentication mechanisms that utilize AAA protocols as carriers. These authentication mechanisms are numerous, and it is not optimal to select an AAA server based solely on the AAA protocol that is used. AAA clients currently lack the ability of deciding which AAA server to direct access requests to on a level lower than that of AAA protocols.
Also, the same problem is apparent in Virtual Private Networks (VPN). Currently, AAA clients are only capable of selecting AAA servers based on assigned user groups in VPN establishment requests. For instance, an AAA client detects a tunnel establishment request, and issues an authentication to an AAA server listed in its list of AAA server. For a certain user group, there is a specified list of AAA servers. Thus, for an AAA client to detect which list of AAA server to use the supplicant must send a specific user name or identifier to the AAA client and based on this, the AAA client decides which list of AAA server to issue the authentication request to. However, deciding which server to issue authentication requests to based on predetermined user groups is not optimal, and AAA clients currently lack the ability of deciding which AAA server to issue such requests to on a level lower than that of user groups in VPN establishment attempts.
Another issue in AAA networks is network configuration. One approach for AAA network configuration includes maintaining an AAA server in a single location to handle all requests for all AAA protocols, e.g., either RADIUS or TACACS+. If the network topology includes AAA clients located in remote branch offices, such clients may need to forward access requests to the AAA server over the wide area network (WAN).
This approach has numerous disadvantages. One scenario where these disadvantages are exploited is when the link between a branch office and the full-scale AAA server is disrupted. The AAA client in the branch office is unable to forward access requests to the AAA server, and users requiring authentication are not serviced and the branch of supplicants associated with the AAA client become dysfunctional.
Another disadvantage is that maintaining a single AAA server for every authentication mechanism associated with an AAA protocol creates large administration and maintenance overheads. Also, the database of all users in the entire enterprise is kept by the full-scale AAA servers and managed by those servers, which increases management costs associated with the AAA servers. Moreover, the abundance of different authentication mechanisms generates more traffic between supplicants, AAA clients and AAA servers than other more common mechanisms. This traffic generates large amount of load on WAN links and full-scale AAA servers.
Another approach is to have an AAA client use a full-scale backup AAA server in the remote branch office. However, this approach also carries the high maintenance, management and administration costs associated with keeping a full scale AAA server at the branch location. Moreover, if the link between the branch office and the full-scale backup server is disrupted, the local area network (LAN) traffic will flood the backup full scale AAA server in the remote branch office, and subsequently generate a large amount of load on the LAN.
Another approach is for the AAA client itself to hold identity data related to supplicants. The disadvantages with this approach are the maintenance and administration costs of configuring each supplicant's user's details on each and every AAA client and the lack of scalability for large AAA networks.
Therefore, it is desirable to keep a local AAA server within a remote branch office to process certain authentication requests when the branch is disconnected from the central, full scale AAA server. However, this is helpful only if the AAA client can differentiate among different types of authentication mechanisms and select either the local or full-scale AAA servers based on those authentication mechanisms.
Therefore, based on the foregoing, there is a clear need for a method of managing AAA network configurations that does not suffer from the limitations of prior approaches.